Clean-label Poisoning Attack and Defense Game for Federated Learning in Vehicular Networks

Clean-label Poisoning Attack and Defense Game for Federated Learning in Vehicular Networks Yalin E. Sagduyu∗ , Tugba Erpek∗ , Nathan Stephenson∗ , Mengran Xue† ∗ Nexcepta Inc., Gaithersburg, MD, USA

arXiv:2610.32765v1 [cs.NI] 23 Oct 2026

† RTX BBN Technologies, Cambridge, MA, USA

Abstract—This paper studies interactions between clean-label poisoning attack and defense in vehicular networks using federated learning (FL). Basic Safety Message (BSM) classification for anomaly detection is modeled as a distributed learning problem over a vehicular network with dynamic topology. As a critical threat to FL, a feature-space clean-label attack is introduced, wherein benign samples are perturbed toward malicious feature extremes, degrading class separability while preserving labels. To counter this, a feature-consistency relabeling defense is proposed to detect and relabel suspicious samples. A game-theoretic framework is developed to capture attack-defense interactions and characterize equilibrium strategies based on attack effectiveness and cost parameters. Results show that the attack scales effectively with compromised nodes, while the proposed defense keeps attack success low without degrading clean accuracy and shifts equilibrium regions toward attack-averse regimes. Index Terms—Vehicular networks, anomaly detection, federated learning, poisoning attack, defense, game.

I. I NTRODUCTION Vehicular networks rely on continuous exchange of Basic Safety Messages (BSMs) to support situational awareness and safety-critical applications such as collision avoidance and traffic management. These messages carry time-sensitive vehicle state information, and their reliability is critical, as falsified data can lead to hazardous outcomes. Hence, accurate classification into benign and malicious messages is essential. Centralized anomaly detection approaches struggle in vehicular networks due to data heterogeneity, privacy constraints, and dynamic topology. Federated learning (FL) enables distributed training without raw data sharing and plays a key role in enhancing vehicular security applications [1]–[5]. However, FL introduces new vulnerabilities, as compromised nodes can inject poisoned data into global model training [6]–[10], posing serious threats to vehicular networks [11], [12]. Among adversarial threats, clean-label poisoning attacks [13] are difficult to detect, as they preserve labels and avoid obvious anomalies, evading standard validation and detection methods. We present a clean-label attack for FL that manipulates features while preserving labels to blur class boundaries and shift decisions. Attack success is evaluated by applying the same feature replacements to malicious test samples, without a learned trigger. We show that the attack propagates through FL aggregation, degrading malicious-sample detection while preserving high accuracy on clean (unperturbed) data. To address these challenges, defense methods must go beyond conventional anomaly detection and explicitly account for feature-label consistency. To that end, we present a defense

method that identifies samples whose features are statistically inconsistent with their labels and relabels suspicious samples, removing residual outliers. By combining feature-to-class distance, malicious-tail and neighborhood-label consistencies, model-loss inconsistencies, and duplicate-pattern indicators, this defense significantly reduces attack success while preserving nominal performance in FL. Attack and defense effectiveness depends on costs, deployment decisions, and adversarial scale, leading to strategic interactions. We model these interactions as a non-cooperative game, where the attacker and defender each optimize their strategy in response to the other. The attacker trades off attack success against the cost for launching an attack, while the defender balances reduction in attack success against defense cost. We then characterize Nash equilibria for attacker and defender strategies, identify operating regions, and analyze how system parameters influence security outcomes. The main contributions are: (i) a feature-space clean-label attack for FL in vehicular networks; (ii) a feature-consistency relabeling defense; and (iii) a game-theoretic analysis of attack-defense interactions and system-level impacts. The remainder of the paper is organized as follows. Sec. II describes anomaly detection with FL in vehicular networks. Sec. III presents the clean-label poisoning attack. Sec. IV introduces the feature-consistency-based defense. Sec. V formulates the game and derives equilibria. Sec. VI characterizes equilibrium regions and utilities. Sec. VII concludes the paper. II. A NOMALY D ETECTION IN F EDERATED L EARNING A. Anomaly Detection Problem in Vehicular Networks We consider the VeReMi extension dataset for misbehavior detection in vehicular networks [14]. The dataset consists of BSMs exchanged among vehicles in a dynamic vehicular network (VANET). Each received message is represented as a feature vector x ∈ Rd , where d denotes the feature dimension of each safety-message sample. The underlying features encode kinematic states (e.g., position, velocity, acceleration), temporal consistency, and cross-vehicle plausibility metrics derived from neighboring observations. Each sample is associated with a binary label y ∈ {0, 1}, where y = 0 denotes a benign (physically consistent) message and y = 1 denotes a malicious (falsified or inconsistent) message. The learning objective is to construct a classifier fθ : Rd → {0, 1},

(1)

(2)

where Ni is the number of samples at vehicle i, xi,j ∈ Rd is the j-th feature vector, and yi,j ∈ {0, 1} is its label. At communication round t, each node maintains a local model (t) θi . The FL process consists of two steps. (i) Local Training. Each client updates its model by minimizing empirical risk: X 1 (t) ℓ(fθ (x), y), (3) θ̂i = arg min θ |Di | (x,y)∈Di

where ℓ(·) is a classification loss function. (ii) GraphConstrained Aggregation. Model updates are shared over a time-varying communication graph G(t) = (V, E (t) ). Each node aggregates neighbor models as X (t+1) (t) (t) θi = wij θ̂j , (4) (t)

∪{i}

weights. Federated averaging is applied over graph-induced connected components. This decentralized learning process reflects realistic vehicular constraints, including dynamic connectivity and data heterogeneity, but introduces vulnerabilities as poisoned local updates can propagate through aggregation. III. C LEAN -L ABEL P OISONING ATTACK We consider a clean-label poisoning attack in which adversarial samples retain their labels but their features are modified. Let DiB and DiM denote benign and malicious samples, respectively, at vehicle i. The attacker selects a subset (5)

and modifies their feature vectors while preserving labels: (x, y = 0) → (x̃, y = 0).

(6)

For feature-space manipulation, let S ⊂ {1, . . . , d} denote informative features selected by top SHAP scores. A target vector t is built using upper-tail statistics of malicious samples:   tk = Qq {x(k) : (x, y) ∈ DiM } , k ∈ S, (7) where Qq (·) denotes the empirical q-th quantile, i.e., the value below which a fraction q of the samples lie. In numerical results, high malicious-tail quantiles (> 0.99) are used for the attack target. Each selected benign sample is modified as xk ← tk ,

∀k ∈ S.

0.7 0.6 0.5

Clean accuracy (no defense) Attack success (no defense) Clean accuracy (defense) Attack success (defense)

0.4 0.3

0.0

0 (No Attack)

10

20

30

(8)

40

50

60

70

80

90

Number of attacked nodes, nA

Fig. 1: Attack and defense effects on FL.

The attack modifies selected features coordinate-wise. The poisoned benign feature distribution is modeled as PB′ (x) = (1 − ϵ)PB (x) + ϵPT (x),

(9)

where PB (x) denotes the original benign feature distribution, PT (x) denotes the attacker-defined target feature distribution concentrated near malicious feature extremes, and ϵ is the poisoning rate, i.e., the fraction of benign samples that are poisoned. This approach reduces class separability and shifts the decision boundary. As a result, the classifier is trained on feature-manipulated benign-labeled samples that resemble malicious patterns, leading to fθ (x) ≈ 0

(t) (t) where Ni denotes the neighbor set and wij are normalized

D̃iB ⊂ DiB

0.8

0.1

We adopt an FL framework over a set of vehicles V. Each vehicle i ∈ V maintains a local dataset

j∈Ni

0.9

0.2

B. Federated Learning over Vehicular Networks

i Di = {(xi,j , yi,j )}N j=1 ,

1.0

Probability

that predicts the label y from x. At each node, a deep neural network is trained with d input features (up to 22), two hidden layers of sizes 128 and 32 with ReLU activations, and a 2unit output layer, using cross-entropy loss. Malicious samples often lie in sparse or extreme feature regions yet overlap with benign ones, enabling label-preserving attacks that exploit feature correlations rather than obvious anomalies.

for x ∼ PT ,

(10)

causing target-pattern samples to be classified as benign. Thus, the attack success probability P (fθ (x) = 0 | y = 1, x ∼ PT ) increases. Attack success is evaluated by modifying malicious test samples using the same feature replacements, replacing selected coordinates with target values. This avoids explicit triggers and tests whether they are classified as benign. For numerical results, we set ϵ = 0.1 and select S ⊂ {1, . . . , d} from top-scoring informative features, with the subset size chosen to maximize attack success. Fig. 1 shows that clean accuracy remains nearly constant as the number of attacked nodes, nA , increases, indicating that the attack preserves clean accuracy while maintaining label consistency. Without defense, attack success increases significantly with more compromised nodes, demonstrating scalability in FL. Attack success is measured on malicious samples with selected features modified according to the attack. With the proposed defense, attack success remains low while preserving clean accuracy, indicating effective mitigation through improved feature-label consistency. IV. F EATURE -R ELABEL D EFENSE To counter clean-label poisoning, we propose a featureconsistency-based relabeling defense that identifies benignlabeled samples exhibiting malicious characteristics. For feature subspace modeling, class means and coordinate-wise standard deviations are estimated as (µB , σ B ) and (µM , σ M ) over a selected informative feature subset capturing the most

discriminative variations. A diagonal covariance approximation is adopted for efficient computation. (i) Distance-based suspicion score is given by sdist (x) = dB (x) − dM (x),

(11)

where X  xk − µB,k 2 X  xk − µM,k 2 dB (x) = , dM (x) = . σB,k σM,k k∈S k∈S (12) A larger sdist indicates that the sample is closer to the malicious distribution than to the benign distribution. (ii) Tail-consistency score is given by X stail = 1{xk ≥ ϕk }, (13) k∈S (k) where XM = {xk : (x, y) ∈ DiM } is the set of malicious-

sample values in feature dimension k and the malicious (k) quantile thresholds are ϕk = Qq (XM ). (iii) Neighborhood consistency score is given by 1 X 1{yj = 1} (14) sknn = K

A. Strategy Spaces The strategy sets are given by SD = {D, ND}, SA = {A, NA},

where D and ND denote defense and no defense, and A and NA denote attack and no attack, respectively. Action A attacks nA > 0 nodes. If nA = 0, the action is NA. B. Payoff Model Let rA (nA ) and rD (nA ) denote the attack success probabilities under no defense and under defense, respectively. By construction, we have rA (nA ) ≥ rD (nA ),

sloss = ℓ(fθ (x), 0),

(15)

where ℓ(·) is cross-entropy loss with benign label y = 0. (v) Duplicate-pattern consistency score sdup counts nearidentical samples, as deterministic overwriting may produce repeated patterns. Thus, sdup increases with the multiplicity of such samples in the benign-labeled set. All suspicion scores are then combined as weighted sum:

∀nA ,

(18)

i.e., defense reduces attack effectiveness as shown in Fig. 1. The attacker incurs a cost cA > 0 for attacking, and the defender incurs a cost cD > 0 for defending. Utility is defined as reward minus cost for each player. The attacker’s reward is the attack success probability, while the defender’s reward is the reduction in attack success probability. For nA > 0, the payoff matrix is then given by

j∈NK (x)

and computed as the fraction of malicious labels among the K nearest neighbors of each sample (K = 11 is used in results). (iv) Loss-based inconsistency score is given by

(17)

D ND

A (−rD (nA ) − cD , rD (nA ) − cA ) (−rA (nA ), rA (nA ) − cA )

NA (−cD , 0) (0, 0)

(19)

When nA = 0, the attacker does not launch an attack and the outcome reduces to (ND, NA) for cD > 0. Note that clean accuracy (evaluated on non-triggered test data) is comparable under both defense and no-defense settings as shown in Fig. 1; therefore, it is not explicitly included in the defender utility, which focuses on attack success and defense cost. C. Best Responses Define the benefit of defense as

S(x) = α1 sdist + α2 stail + α3 sloss + α4 sknn + α5 sdup , (16)

∆(nA ) = rA (nA ) − rD (nA ) > 0.

where α1 = 1.75, α2 = 1.25, α3 = α4 = 0.5 and α5 = 0.75 are set in numerical results. The defense operates on benignlabeled samples B and is applied once per node as a preprocessing step before federated updates. It identifies a subset E = {x ∈ B : S̃(x) ≥ τ } of suspicious samples based on the standardized (z-score) suspicion score S̃(x) and threshold τ . In numerical results, this threshold is set to 2.25. From E, a subset R of highest-score samples (up to a relabeling budget) is relabeled as malicious (y ← 1). Relabeling is performed before removal. The remaining samples E \ R are considered for removal; those exceeding a stricter threshold or within a removal budget are discarded. This procedure mitigates featurelabel inconsistency by relabeling likely poisoned samples and removing extreme outliers, reducing benign contamination, improving class separability, and decreasing attack success.

The following best-response conditions hold for nA > 0. The attacker prefers to attack if

V. G AME FOR ATTACK -D EFENSE I NTERACTIONS We consider a two-player normal-form game between the defender and the attacker, where the defender chooses whether to deploy protection and the attacker decides whether to attack. The number of attacked nodes, nA ∈ {0, 1, . . . , nmax A }, is a fixed parameter, with nA = 0 corresponding to no attack.

(20)

against D :

cA ≤ rD (nA ),

(21)

against ND :

cA ≤ rA (nA ).

(22)

The defender prefers to defend against an attack if cD ≤ ∆(nA ).

(23)

If attacker chooses NA, defender prefers ND for any cD > 0. D. Pure-Strategy Nash Equilibria (D, A) is a Nash equilibrium if and only if cA ≤ rD (nA ),

cD ≤ ∆(nA ).

(24)

(ND, A) is a Nash equilibrium if and only if cA ≤ rA (nA ),

cD ≥ ∆(nA ).

(25)

(ND, NA) is a Nash equilibrium if and only if cA ≥ rA (nA ).

(26)

For cD > 0, (D, NA) is not a Nash equilibrium. It is a weak Nash equilibrium when cD = 0 and cA ≥ rD (nA ).

1.0

E. Mixed-Strategy Equilibrium For nA > 0, let pD ∈ [0, 1] denote the probability that the defender plays D, and let pA ∈ [0, 1] denote the probability that the attacker plays A. The defender is indifferent when

0.8

Defender cost cD

−pA rD (nA ) − cD = −pA rA (nA ),

(27)

which yields

cD . ∆(nA ) The attacker is indifferent when

pD rD (nA ) − cA + (1 − pD ) rA (nA ) − cA = 0, p∗A =

Pure NE: (D, A) Mixed NE Pure NE: (ND, A) Pure NE: (ND, NA)

0.9

(28)

0.7

(ND, A)

0.6

(ND, NA)

0.5 0.4 0.3 0.2

(D, A)

Mixed

0.1 0.0 0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

Attacker cost parameter cA

(29)

Fig. 2: Equilibrium regions in the (cA , cD ) plane.

which yields p∗D =

rA (nA ) − cA . ∆(nA )

(30)

In equilibrium, this indifference implies zero attacker payoff. A strict mixed equilibrium exists if and only if rD (nA ) < cA < rA (nA ),

0 < cD < ∆(nA ).

(31)

When nA = 0, no nodes are attacked and the attacker does not incur any attack cost. In this case, the outcome corresponds to no attack, and for cD > 0, the defender does not deploy defense. Therefore, the equilibrium reduces to (ND, NA). VI. G AME E QUILIBRIUM R EGIONS AND U TILITIES For given nA >0, the equilibrium structure derived in Sec. V induces a partition of the (cA , cD ) parameter space. Let ∆(nA ) = rA (nA ) − rD (nA ) > 0.

(32)

The equilibrium regions follow from the best-responses of the attacker and defender. The attacker is indifferent at cA = rD (nA ),

cA = rA (nA ),

(33)

which correspond to the vertical boundaries cA = rD (nA ),

cA = rA (nA ).

(34)

The defender is indifferent when cD = ∆(nA ),

(35)

which defines a horizontal boundary. These thresholds partition the (cA , cD ) plane into four regions: (D, A) : cA ≤ rD (nA ), cD ≤ ∆(nA ), (ND, A) : cA ≤ rA (nA ), cD ≥ ∆(nA ), (ND, NA) : cA ≥ rA (nA ),

(36)

Mixed : rD (nA ) < cA < rA (nA ), 0 < cD < ∆(nA ). The equilibrium is defined by vertical boundaries cA = rD (nA ), cA = rA (nA ), and a horizontal boundary cD = ∆(nA ). The region plot is constructed by filling rectangular max max subsets of a bounded domain (cA , cD ) ∈ [0, CA ]×[0, CD ]: (D)

(D, A) : [0, τA ] × [0, ∆], (ND)

(ND, A) : [0, τA

max ] × [∆, CD ],

(ND)

max max , CA ] × [0, CD ],

(D)

(ND)

(ND, NA) : [τA

Mixed : [τA , τA

] × [0, ∆],

(37)

where

(D)

τA

= rD (nA ),

(ND)

τA

= rA (nA ).

(38)

The equilibrium exhibits a threshold structure governed by cA and ∆(nA ), with boundaries at cA = rD (nA ), cA = rA (nA ), and cD = ∆(nA ). Region variations are driven by rD (nA ), rA (nA ), and ∆(nA ), causing attack and no-attack regions to expand or contract. The mixed region arises when rD (nA ) < cA < rA (nA ), where attacking is profitable without defense but not under defense, leading to randomization and zero attacker payoff. The defender’s utility decreases with cD and is maximized in the no-attack region. Fig. 2 illustrates this partition for nA = 40, where small changes in cA near rD (nA ) and rA (nA ) cause sharp transitions. Larger ∆(nA ) raises the threshold cD = ∆(nA ), expanding the defense-relevant and mixed regions, corresponding to greater reduction in attack success, while the no-attack region is determined by cA = rA (nA ). The attacker and defender utilities are given by  rD (nA ) − cA , (D, A),    r (n ) − c , (ND, A), A A A (39) UAeq =  0, (ND, NA),    0, Mixed,  −rD (nA ) − cD , (D, A),     −rA (nA ), (ND, A), eq UD = 0, (40) (ND, NA),    c  − D rA (nA ), Mixed. ∆(nA ) In the mixed region, the equilibrium probabilities given in eq (28) and (30) imply UAeq = 0 and UD = −p∗A rA (nA ). Fig. 3 shows that attacker utility is positive only in pure attack regions and zero in the mixed and (ND, NA) regions, with the mixed region forming a zero-utility plateau. Fig. 4 shows defender utility is maximized in (ND, NA), independent of cD in (ND, A), and decreasing with cD in (D, A) and mixed regions. These confirm the threshold structure and that shifts with nA are driven by rD (nA ), rA (nA ), and ∆(nA ). For each fixed nA , total equilibrium areas are computed max max over (cA , cD ) ∈ [0, CA ] × [0, CD ] using thresholds cA = rD (nA ), cA = rA (nA ), and cD = ∆(nA ), where

1.0

0.5

0.9

Defender cost cD

0.7

0.3

Pure NE (ND, A)

0.6

0.2

Pure NE (ND, NA)

0.5 0.4

0.1

0.3 0.2 0.1

Pure NE (D, A)

0.0 0.0

0.1

Equilibrium attacker utility

0.4

0.8

Mixed NE

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.0

ACKNOWLEDGEMENTS

0.0

Attacker cost parameter cA

0.0

0.9

−0.1

Defender cost cD

0.8

−0.2

0.7

Pure NE (ND, A)

0.6

−0.3

Pure NE (ND, NA)

0.5

−0.4

0.4 0.3 0.2 0.1

Pure NE (D, A)

0.0 0.0

0.1

−0.5

Mixed NE

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

Equilibrium defender utility

Fig. 3: Equilibrium attacker utility over the (cA , cD ) plane. 1.0

1.0

Attacker cost parameter cA

Fig. 4: Equilibrium defender utility over the (cA , cD ) plane. 1.0

No attack Attack

Total equilibrium area

0.9

No defense Defense

0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.0 10

20

30

40

50

60

70

80

overlap to remain stealthy and scalable, and is evaluated by modifying malicious samples without explicit triggers. The relabeling defense improves feature-label consistency using distance, tail, neighborhood, loss-based, and duplicate-pattern evidence. Game-theoretic analysis reveals threshold structures governing equilibria and how defense effectiveness reshapes attacker incentives. Results show reduced attack success and a shift toward no-attack equilibria, strengthening the FL security of vehicular networks under emerging threat conditions.

90

Number of attacked nodes nA

Fig. 5: Equilibrium areas for attack/defense decisions.

∆(nA ) = rA (nA ) − rD (nA ). Pure-strategy regions contribute rectangular areas directly, while the mixed region is apportioned using equilibrium mixing probabilities. For nA = 0, the equilibrium is (ND, NA) over the full domain. Fig. 5 shows areas versus nA under fixed cA . For nA > 0, areas vary with rD (nA ), rA (nA ), and ∆(nA ). The attack and defense regions increase with nA , while the no-attack and no-defense regions decrease, since larger rA (nA ), rD (nA ), and ∆(nA ) expand the corresponding thresholds. Consequently, larger ∆(nA ) strengthens defense impact and shifts the system toward noattack dominance, enabling attack-deterring equilibria. VII. C ONCLUSION This paper presented a unified framework for clean-label poisoning and defense in FL used for anomaly detection in vehicular networks. The feature-space attack exploits feature

Research was sponsored by the Army Research Laboratory under RTX BBN Technologies, Inc. subcontract and was accomplished under Cooperative Agreement Number W911NF24-2-0131. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Army Research Laboratory or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein. R EFERENCES [1] A. M. Elbir, B. Soner, S. Çöleri, D. Gündüz, and M. Bennis, “Federated learning in vehicular networks,” in IEEE International Mediterranean Conference on Communications and Networking (MeditCom), 2022. [2] J. Huang, Y. Jiang, S. Gyawali, Z. Zhou, and F. Zhong, “Semi-supervised federated learning for misbehavior detection of BSMs in vehicular networks,” in IEEE Vehicular Technology Conference (VTC), 2024. [3] C.-K. Tham, L. Yang, A. Khanna, and B. Gera, “Federated learning for anomaly detection in vehicular networks,” in IEEE Vehicular Technology Conference (VTC), 2023. [4] Z. Wang and T. Yan, “Federated learning-based vehicle trajectory prediction against cyberattacks,” in IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN), 2023. [5] B. Li, X. Chen, T. Zhang, H. Sun, L. Dong, B. Chen, W. Zhuang, and G. Yin, “Fed-SecTP: A federated learning-based framework for secure vehicle trajectory prediction using surrounding vehicle data,” IEEE Internet of Things Journal, 2025. [6] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in European Symposium on Research in Computer Security. Springer, 2020. [7] M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-Robust federated learning,” in USENIX Security, 2020. [8] Z. Ma, J. Ma, Y. Miao, Y. Li, and R. H. Deng, “ShieldFL: Mitigating model poisoning attacks in privacy-preserving federated learning,” IEEE Transactions on Information Forensics and Security, 2022. [9] Y. E. Sagduyu, T. Erpek, and Y. Shi, “Securing NextG systems against poisoning attacks on federated learning: A game-theoretic solution,” in IEEE Military Communications Conference (MILCOM), 2023. [10] Y. E. Sagduyu, T. Erpek, and Y. Shi, “Poisoning attack and defense game for federated learning in resilient nextg networks,” Autonomous Cyber Resilience, pp. 319–346, 2026. [11] U. Demir, Y. E. Sagduyu, T. Erpek, H. Jafari, S. Kompella, and M. Xue, “Distributed federated learning for vehicular network security: Anomaly detection benefits and multi-domain attack threats,” in ACM Workshop on Wireless Security and Machine Learning, 2025. [12] U. Demir, T. Erpek, Y. E. Sagduyu, S. Kompella, and M. Xue, “Targeted attacks and defenses for distributed federated learning in vehicular networks,” in IEEE Military Communications Conference, 2025. [13] G. Severi, S. Boboila, A. Oprea, J. Holodnak, K. Kratkiewicz, and J. Matterer, “Poisoning network flow classifiers,” in Annual Computer Security Applications Conference (ACSAC), 2023. [14] J. Kamel, M. Wolf, R. W. Van Der Hei, A. Kaiser, P. Urien, and F. Kargl, “VeReMi extension: A dataset for comparable evaluation of misbehavior detection in VANETs,” in IEEE International Conference on Communications (ICC), 2020.

Related documents

• Clean-label Poisoning Attack and Defense Game for Federated Learning in Vehicular Networks#1448281
• AntiFLipper: A Secure and Efficient Defense Against Label-Flipping Attacks in Federated Learning#1104397
• AP-PPFL: an anti-poisoning privacy-preserving federated learning method#142736
• Federated Learning with Privacy-preserving and Model IP-right-protection#177289
• SecuFL-IoT: an adaptive privacy-preserving federated learning framework for anomaly detection in smart industrial networks#20535